io.github.MadeByFYI/madeby

Made by AI (WRITE): record witnessed AI-authorship spans from YOUR OWN session log into the repo's .madeby/spans (asserted tier, self-reported) — how an agent DISCLOSES its own contribution. Honest by construction: it records only spans whose AI-authored content is STRUCTURALLY PRESENT in the checkout (survives reformatting); anything not present is discarded. Writes only derived attribution, locally — the log/content never leave the machine. It cannot claim a higher tier or attribute work to anyone else.

Evaluate a repo's commits against its .madeby/policy.json disclosure policy (the maintainer gate). Returns pass/fail, the policy mode, and the undisclosed commits. The policy file is optional — with no file (or an invalid one) it degrades to advisory (report-only, never a false gate).

Authorship coverage scoreboard for a repo — the honest estimate of how much of the code's authorship is ON THE RECORD (known) vs undisclosed (unknown — origin unknown, NEVER guessed), the human/with_ai/ai mix OF THE KNOWN (never of the whole repo), the asserted-vs-verified trust split, and byAgent: the agents and model versions named in the AI commits, exactly as disclosed (a commit naming a tool and its model counts under both). Disclosure, not detection; the report is a labeled estimate (counts only — derive percents at the edge). Use it to show a maintainer their provenance picture and motivate requiring disclosure.

Disclose authorship on HEAD per ACO — the agent-native disclosure of work you just did. Pick the honest category: 'ai' (an AI authored it; you, the committer, are accountable) adds Authored-by-ai; 'with_ai' (a human authored it WITH AI assistance) adds Authored-by-human + Assisted-by; 'human' adds Authored-by-human. IMPORTANT: if the AI wrote the code and a human is merely committing it, that is 'ai' — do NOT claim 'with_ai'/human authorship the human didn't do. Amends HEAD's MESSAGE only (a testimony, never a content change) and refuses if there are staged changes. Evidence upgrade for the ai category (witnessed spans from a session log) is the CLI `madeby ai --witness`. Read the standard: madeby://guide/aco.

Align a repository with MadeBy in one call: create .madeby/policy.json (advisory by default — reports, never fails) and the CI disclosure check for the host (github default; azure-devops guided). Idempotent — never clobbers an existing policy or workflow; the one change it makes is mode: "required" raising an existing advisory policy to required (it never lowers one). Returns the files created/skipped and the recommended next steps. Read the resources: madeby://guide/align (full workflow), madeby://guide/enforce (make the check required — the host's control plane, exact commands), madeby://guide/backfill (account for existing history honestly — never fabricate). The ACO convention block is versioned: the result flags an `outdated` AGENTS.md/CLAUDE.md (drift); call again with update:true to refresh just that block in place — how an agent keeps the convention current.

Made by whom? Read what's ON THE RECORD about who made this. With `path`: one file's origin — witnessed AI spans (model/tool, precise) where captured, last-touch commit disclosure from git blame elsewhere (approximate, labeled), unknown otherwise. With no `path`: a repo-wide map (the orientation to read BEFORE you work) — the witnessed AI surface plus commit-level disclosure coverage, cheap (no per-file blame). The universal contract is the line range: for a symbol, turn it into a line range with your own tooling (tree-sitter/LSP/ctags) and pass it — MadeBy never parses code. Disclosure, not detection: it reports what's disclosed and never asserts 'human'.